Likely to be the first of many US companies adopting this simple solution.

Oracle has revealed that it is now keeping all data regarding EU citizens within the European Union. This allows it to comply in a straightforward way with the ruling from the Court of Justice of the European Union (CJEU) that is likely to result in EU-US data transfers made using the Safe Harbour framework being deemed illegal.

According to The Irish Times, Thomas Kurian, president of product development at Oracle, said at Oracle’s annual OpenWorld conference in San Francisco: "All of our data centres in Europe have European operators. They have local production and, within the same European legislative region, disaster recovery. No data is sent across the geographical boundaries to any other legislative boundary." As a result, Kurian added: "we are very comfortable with where we are with our cloud offerings and the new regulatory framework around data governance."

According to the article, Oracle has data centres in several EU countries, including the UK, Germany, and the Netherlands.

Oracle is not known for meekly accepting court rulings, as its behaviour in the lawsuit against Google shows. Oracle's decision to store EU data on EU servers suggests that it has decided to try to differentiate itself from competitors by fully embracing the ruling, and guaranteeing that none of the personal data it holds on European citizens will flow to the US.

Further Reading

Other US companies may well follow suit. Back in May, Twitter changed its privacy policy to reflect the fact that non-US users were handled by its data centre in Ireland, rather than California. Earlier this month, the The Wall Street Journal reported Google, Microsoft, Apple and Amazon have opened or expanded their data centres in Europe, with an eye to complying with EU privacy laws more easily.

Even though the European Commissioner for Justice, Consumers and Gender Equality, Vera Jourova, has said that the EU and the US had "agreed in principle" on a new Safe Harbour framework, it is far from clear whether it would survive a legal challenge in the light of the CJEU ruling. That makes promising to keep EU data strictly within the EU—as Oracle is now doing—a relatively safe and straightforward option for US companies that require certainty for their business operations.

If others follow Oracle's example, it seems likely that EU data centres for EU personal data could well become the de facto solution, even if it is not a formal requirement of the relevant EU laws.